Alertmanager handles alerts sent by client applications such as the Prometheus server. An attacker with the permission to perform POST requests on the /api/v1/alerts endpoint could be able to execute arbitrary JavaScript code on the users of Prometheus Alertmanager. This issue has been fixed in Alertmanager version 0.2.51.
{ "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "0.6.2+ds-3ubuntu0.1+esm1", "binary_name": "golang-github-prometheus-alertmanager-dev" }, { "binary_version": "0.6.2+ds-3ubuntu0.1+esm1", "binary_name": "prometheus-alertmanager" }, { "binary_version": "0.6.2+ds-3ubuntu0.1+esm1", "binary_name": "prometheus-alertmanager-dbgsym" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "0.15.3+ds-3ubuntu1.2", "binary_name": "golang-github-prometheus-alertmanager-dev" }, { "binary_version": "0.15.3+ds-3ubuntu1.2", "binary_name": "prometheus-alertmanager" }, { "binary_version": "0.15.3+ds-3ubuntu1.2", "binary_name": "prometheus-alertmanager-dbgsym" } ] }
{ "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "0.23.0-4ubuntu0.2+esm1", "binary_name": "golang-github-prometheus-alertmanager-dev" }, { "binary_version": "0.23.0-4ubuntu0.2+esm1", "binary_name": "prometheus-alertmanager" }, { "binary_version": "0.23.0-4ubuntu0.2+esm1", "binary_name": "prometheus-alertmanager-dbgsym" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "0.27.0+ds-2", "binary_name": "golang-github-prometheus-alertmanager-dev" }, { "binary_version": "0.27.0+ds-2", "binary_name": "prometheus-alertmanager" }, { "binary_version": "0.27.0+ds-2", "binary_name": "prometheus-alertmanager-dbgsym" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "0.26.0+ds-1ubuntu0.1", "binary_name": "golang-github-prometheus-alertmanager-dev" }, { "binary_version": "0.26.0+ds-1ubuntu0.1", "binary_name": "prometheus-alertmanager" }, { "binary_version": "0.26.0+ds-1ubuntu0.1", "binary_name": "prometheus-alertmanager-dbgsym" } ] }